Docket No.: 1032-002US01 



CLAIMS: 

1 . A method comprising: 

capturing network packets using a plurality of distributed agents; 

identifying duplicate network packets that were captured by different agents; and 

displaying a subset of the network packets based on the identification. 

2. The method of claim 1 , wherein displaying a subset of the network packets 
comprises: 

displaying the non-duplicate network packets; and 
displaying a representative packet for the duplicate packets. 

3. The method of claim 1 , wherein displaying a representative packet comprises: 
comparing timestamps of the duplicate packets, and 

displaying one of the packets based on the comparison. 

4. The method of claim 1 , wherein displaying a subset of the network packets further 
comprises: 

filtering the non-duplicate packets; and 
displaying the duplicate packets. 

5. A method comprising: 

capturing network packets using a plurality of distributed agents; 
communicating the captured network data to an aggregator; and 
aggregating the captured network packets into sets of network packets based on 
source information and destination information for the network packets. 

6. The method of claim 5, wherein aggregating the captured network packets comprises: 
sorting the network packets based on timestamps of the network packets; 
assigning the network packets having equal source information and equal destination 

information to a common set; and 

identifying within the sets duplicate packets that were captured by different agents. 
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7. The method of claim 6, further comprising displaying a subset of the network packets 
based on the identification. 

8. The method of claim 6, wherein identifying duplicate packets comprises: 
identifying network packets having equal sequence numbers and acknowledgement 

numbers; and 

performing a byte-by-byte comparison for payloads of the identified packets. 

9. The method of claim 5, wherein the source information comprises one of a media 
access control (MAC) address and a Data Link Control (DLC) address for a source network 
device. 

10. The method of claim 5, wherein the destination information comprises one of a media 
access control (MAC) address and a Data Link Control (DLC) address for a destination 
network device. 

1 1 . The method of claim 6, further comprising displaying non-duplicate data packets of 
one of the sets. 

12. The method of claim 1 1, wherein displaying non-duplicative packets comprises 
displaying a representative packet for the duplicate packets. 

13. The method of claim 1 1 , wherein displaying a representative packet comprises: 
comparing timestamps of the duplicate packets, and 

displaying one of the packets based on the comparison. 

14. A method comprising: 

capturing network packets using a plurality of distributed agents; 
communicating the captured network data to an aggregator; 
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aggregating the captured network packets into sets of network packets based on 
source information and destination information for the network packets; and 
graphically illustrating the set of aggregated network packets. 

15. The method of claim 14, further comprising: 

selecting one of the sets of aggregated network packets in response to user input; and 
displaying the packets of the selected set. 

1 6. The method of claim 1 5, wherein displaying the packets of the selected set comprises: 
identifying within the sets duplicate packets that were captured by different agents; 

and 

displaying non-duplicate data packets of the selected set. 

17. The method of claim 16, further comprising displaying a representative packet for the 
duplicate packets. 

1 8. The method of claim 1 7, wherein displaying a representative packet comprises: 
comparing timestamps of the duplicate packets, and 

displaying one of the packets based on the comparison. 

19. The method of claim 1 7, further comprising displaying the remainder of the duplicate 
packets in response to user input. 

20. The method of claim 17, further comprising: 

displaying an expandable graphical icon proximate the representative packet; and 
displaying the remainder of the duplicate packets based on user input selecting the 
expandable graphical icon. 

21 . The method of claim 14, wherein capturing network packets comprises 
communicating start and stop commands from the aggregator to the agents. 
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22. A system comprising: 

a plurality of distributed agents to capture packets from a network; 

an aggregation module coupled to the network to receive the captured packets, 
wherein the aggregation module identifies duplicate packets that were captured by different 
agents; and 

a display coupled to the aggregation module, wherein the aggregation module 
presents the non-duplicate network packets on the display. 

23. The system of claim 22, wherein the aggregation module presents a representative 
packet for the duplicate packets on the display. 

24 The system of claim 23, wherein the agents assign the captured packets timestamps, 
and further wherein the aggregation module compares the timestamps of the duplicate 
packets and selects one of the duplicate packets for display as the representative packet. 

25. The system of claim 23, wherein the aggregation module displays the remainder of 
the duplicate packets in response to user input selecting the representative packet. 

26. The system of claim 22, wherein the aggregation module identifies duplicate packets 
by identifying packets having equal sequence numbers and acknowledgement numbers, and 
by performing a byte-by-byte comparison for payloads of the identified packets. 

27. The system of claim 22, wherein the aggregation module assigns the captured packets 
into sets of packets based on source information and destination information for the packets. 

28. The system of claim 22, wherein the agents assign the captured packets timestamps 
and the aggregation module sorts the packets based on timestamps, and further wherein the 
aggregation module assigns the packets having equal source information and equal 
destination information to a common set of packets. 
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29. The system of claim 28, wherein the source information comprises one of a media 
access control (MAC) address and a Data Link Control (DLC) address for a source network 
device. 

30. The system of claim 28, wherein the destination information comprises one of a 
media access control (MAC) address and a Data Link Control (DLC) address for a 
destination network device. 

3 1 . The system of claim 22, further comprising a controller that maintains a 
communication link with each of the agents, wherein the controller issues commands to the 
agents via the communication link to initiate and terminate data capture by the agents. 

32. A medium comprising instructions to cause a processor to: 

direct a plurality of distributed agents to capture packets from a network; 
receive the captured packets; 

identify one or more sets of duplicate network packets that were captured by different 

agents; 

display the non-duplicate network packets; and 

display one of the a representative packet for each set of duplicate packets. 

33. The medium of claim 32, further comprising instructions to cause the processor to: 
compare timestamps of the duplicate packets, and 

display one of the packets based on the comparison. 

34. The medium of claim 32, further comprising instructions to cause the processor to: 
identify network packets having equal sequence numbers and acknowledgement 

numbers; and 

perform a byte-by-byte comparison for payloads of the identified packets. 
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35. The medium of claim 32, further comprising instructions to cause the processor to 
aggregate the captured network packets into sets of network packets based on source 
information and destination information for the network packets. 

36. The medium of claim 35, further comprising instructions to cause the processor to 
sort the network packets based on timestamps of the network packets, assign the network 
packets having equal source information and equal destination information to a common set, 
and identify within the sets duplicate packets that were captured by different agents. 

37. The medium of claim 35, further comprising instructions to cause the processor to 
graphically illustrate the set of aggregated network packets. 

3 8. The medium of claim 37, further comprising instructions to cause the processor to 
select one of the sets of aggregated network packets in response to user input; and display the 
packets of the selected set. 
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